Lucene search

OTRSCVELIST:CVE-2021-21436

HistoryFeb 08, 2021 - 10:55 a.m.

CVE-2021-21436 Agent is able to link customer's Config Items without permission

2021-02-0810:55:20

CWE-264

OTRS

www.cve.org

cve-2021-21436

otrs ag

otrscisincustomerfrontend 7.0.x

general catalog

CVSS3

3.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N

AI Score

4.9

Confidence

High

EPSS

0.001

Percentile

22.7%

JSON

Agents are able to see and link Config Items without permissions, which are defined in General Catalog. This issue affects: OTRS AG OTRSCIsInCustomerFrontend 7.0.x version 7.0.14 and prior versions.

CNA Affected

[
  {
    "product": "OTRSCIsInCustomerFrontend",
    "vendor": "OTRS AG",
    "versions": [
      {
        "lessThanOrEqual": "7.0.14",
        "status": "affected",
        "version": "7.0.x",
        "versionType": "custom"
      }
    ]
  }
]

References

otrs.com/release-notes/otrs-security-advisory-2021-04/

CVSS3

3.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N

AI Score

4.9

Confidence

High

EPSS

0.001

Percentile

22.7%

JSON

Related for CVELIST:CVE-2021-21436